diff --git a/changelog/8.19.20.asciidoc b/changelog/8.19.20.asciidoc new file mode 100644 index 0000000000..a9a0af1b40 --- /dev/null +++ b/changelog/8.19.20.asciidoc @@ -0,0 +1,49 @@ +// begin 8.19.20 relnotes + +[[release-notes-8.19.20]] +== 8.19.20 + +Review important information about the 8.19.20 release. + +[discrete] +[[security-updates-8.19.20]] +=== Security updates + + + + +* Treat output names as parameters in Elasticsearch update scripts. https://github.com/elastic/fleet-server/pull/7543[#7543] https://github.com/elastic/fleet-server/issues/7536[#7536] + + + + + + + + + + +[discrete] +[[enhancements-8.19.20]] +=== Enhancements + + + + +* Bump elastic-agent-libs to v0.46.0 for FIPS 140-3 peer cert key-type enforcement. https://github.com/elastic/fleet-server/pull/7456[#7456] https://github.com/elastic/fleet-server/issues/7536[#7536] + + + + +[discrete] +[[bug-fixes-8.19.20]] +=== Bug fixes + + + + +* Fix agent enrollment failures caused by 409 version conflicts during `.fleet-agents` primary shard relocation. https://github.com/elastic/fleet-server/pull/7446[#7446] +* Retain output API key secrets when agent document updates fail. https://github.com/elastic/fleet-server/pull/7547[#7547] https://github.com/elastic/fleet-server/issues/7536[#7536] +* Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist. https://github.com/elastic/fleet-server/pull/7548[#7548] + +// end 8.19.20 relnotes diff --git a/changelog/8.19.20.yaml b/changelog/8.19.20.yaml new file mode 100644 index 0000000000..f3ad0f3c54 --- /dev/null +++ b/changelog/8.19.20.yaml @@ -0,0 +1,78 @@ +version: 8.19.20 +entries: + - kind: enhancement + summary: Bump elastic-agent-libs to v0.46.0 for FIPS 140-3 peer cert key-type enforcement + description: | + Bump elastic-agent-libs to v0.46.0 which enforces FIPS 140-3 compliant peer + certificate key types across all TLS verification modes. Also set the + fips140=on GODEBUG default in the FIPS binary so it enforces FIPS mode at + runtime, and verify this in the binary FIPS marker check. + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7456 + issue: + - https://github.com/elastic/fleet-server/issues/7536 + impact: "" + action: "" + timestamp: 1783518046 + file: + name: 1783518046-Bump-elastic-agent-libs-for-FIPS-peer-cert-enforcement.yaml + checksum: 4a10327d1d112aae226e85943d1a9e6d68401369 + - kind: bug-fix + summary: Fix agent enrollment failures caused by 409 version conflicts during `.fleet-agents` primary shard relocation + description: "" + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7446 + issue: [] + impact: "" + action: "" + timestamp: 1785185160 + file: + name: 1785185160-enrollment-version-conflict.yaml + checksum: dfa448208740beda8ed226ca97043992763f791e + - kind: security + summary: Treat output names as parameters in Elasticsearch update scripts + description: "" + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7543 + issue: + - https://github.com/elastic/fleet-server/issues/7536 + impact: "" + action: "" + timestamp: 1785505460 + file: + name: 1785505460-parameterize-output-painless-scripts.yaml + checksum: bbf0031cb9a16726b0cb08b07d2c3ba47db8d8e4 + - kind: bug-fix + summary: Retain output API key secrets when agent document updates fail + description: | + Fleet Server no longer deletes a newly created output API key secret when the + corresponding agent document update returns an error. Elasticsearch may have + committed an update even when the client times out waiting for its response; + deleting the secret in that case leaves the agent with a dangling reference. + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7547 + issue: + - https://github.com/elastic/fleet-server/issues/7536 + impact: "" + action: "" + timestamp: 1785539200 + file: + name: 1785539200-retain-output-secret-on-agent-update-failure.yaml + checksum: c1af6222145fa524c30a68bd2df623aab45c4480 + - kind: bug-fix + summary: Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist + description: "" + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7548 + issue: [] + impact: "" + action: "" + timestamp: 1785788555 + file: + name: 1785788555-token-resolver-index-not-found.yaml + checksum: 83f180df4d44010edb38dfcf98d91ced4811cbb2 diff --git a/changelog/fragments/1783518046-Bump-elastic-agent-libs-for-FIPS-peer-cert-enforcement.yaml b/changelog/fragments/1783518046-Bump-elastic-agent-libs-for-FIPS-peer-cert-enforcement.yaml deleted file mode 100644 index 730f80364d..0000000000 --- a/changelog/fragments/1783518046-Bump-elastic-agent-libs-for-FIPS-peer-cert-enforcement.yaml +++ /dev/null @@ -1,36 +0,0 @@ -# Kind can be one of: -# - breaking-change: a change to previously-documented behavior -# - deprecation: functionality that is being removed in a later release -# - bug-fix: fixes a problem in a previous version -# - enhancement: extends functionality but does not break or fix existing behavior -# - feature: new functionality -# - known-issue: problems that we are aware of in a given version -# - security: impacts on the security of a product or a user’s deployment. -# - upgrade: important information for someone upgrading from a prior version -# - other: does not fit into any of the other categories -kind: enhancement - -# Change summary; a 80ish characters long description of the change. -summary: Bump elastic-agent-libs to v0.46.0 for FIPS 140-3 peer cert key-type enforcement - -# Long description; in case the summary is not enough to describe the change -# this field accommodate a description without length limits. -# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment. -description: | - Bump elastic-agent-libs to v0.46.0 which enforces FIPS 140-3 compliant peer - certificate key types across all TLS verification modes. Also set the - fips140=on GODEBUG default in the FIPS binary so it enforces FIPS mode at - runtime, and verify this in the binary FIPS marker check. - -# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc. -component: fleet-server - -# PR URL; optional; the PR number that added the changeset. -# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added. -# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number. -# Please provide it if you are adding a fragment for a different PR. -#pr: https://github.com/owner/repo/1234 - -# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of). -# If not present is automatically filled by the tooling with the issue linked to the PR number. -#issue: https://github.com/owner/repo/1234 diff --git a/changelog/fragments/1785185160-enrollment-version-conflict.yaml b/changelog/fragments/1785185160-enrollment-version-conflict.yaml deleted file mode 100644 index 04f6831665..0000000000 --- a/changelog/fragments/1785185160-enrollment-version-conflict.yaml +++ /dev/null @@ -1,7 +0,0 @@ -kind: bug-fix - -summary: Fix agent enrollment failures caused by 409 version conflicts during `.fleet-agents` primary shard relocation - -component: fleet-server - -pr: https://github.com/elastic/fleet-server/pull/7446 diff --git a/changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml b/changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml deleted file mode 100644 index 7bce16572c..0000000000 --- a/changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: security -summary: Treat output names as parameters in Elasticsearch update scripts -component: fleet-server diff --git a/changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml b/changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml deleted file mode 100644 index 6dbdb28edb..0000000000 --- a/changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml +++ /dev/null @@ -1,11 +0,0 @@ -kind: bug-fix - -summary: Retain output API key secrets when agent document updates fail - -description: | - Fleet Server no longer deletes a newly created output API key secret when the - corresponding agent document update returns an error. Elasticsearch may have - committed an update even when the client times out waiting for its response; - deleting the secret in that case leaves the agent with a dangling reference. - -component: fleet-server diff --git a/changelog/fragments/1785788555-token-resolver-index-not-found.yaml b/changelog/fragments/1785788555-token-resolver-index-not-found.yaml deleted file mode 100644 index cf7a874420..0000000000 --- a/changelog/fragments/1785788555-token-resolver-index-not-found.yaml +++ /dev/null @@ -1,7 +0,0 @@ -kind: bug-fix - -summary: Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist - -component: fleet-server - -pr: https://github.com/elastic/fleet-server/pull/7548